Most regulatory organizations such as SEC enforce "means", rather than "results". In simple terms: You will not have problems if a bug happens, as long as you c

Most regulatory organizations such as SEC enforce "means", rather than "results". In simple terms: You will not have problems if a bug happens, as long as you can show that you had a reasonable, best of your knowledge, process to avoid bugs (code review, staging changes, fallback plans, regular analysis/checks, etc). This does not seem to be the case for RH unfortunately. They will have to explain why the detection / escalation failed for this issue, why no statements were provided, why it was not spotted by internal analytics/checks, why the pre-trade checks let these trades go, etc. They will probably end up with a huge fine. Disclaimer: I work in a hedge fund that is SFC regulated. I expect the SEC to have pretty much the same policies.